EUVD-2026-46284
GHSA-q3fm-5c2w-6758
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as group administrator
-
DeliveryCraft request with forged object reference
-
ExploitBypass authorization via IDOR (CWE-639)
-
ExecutionEscalate privileges beyond delegated scope
-
PersistExecute code as root on host
-
ImpactFull server and tenant data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated group administrator account on Serv-U (CVSS PR:H) - this is the explicit prerequisite stated by the vendor, not a generic 'access required' condition, meaning the attacker must already hold delegated administrative privileges on the server. Given AV:N/AC:L/UI:N, no victim interaction, no special client-side conditions, and no non-default feature toggle are needed beyond that admin role. Key limiting factors: the group-admin requirement excludes anonymous/regular file-transfer users, and the platform matters - full root RCE applies to Linux/Unix deployments, while the vendor states impact is materially lower on Windows, so Windows-only environments face a reduced-severity outcome. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) shows network reach, low complexity, no user interaction, and a scope change to full host compromise, offset by a high-privilege prerequisite (PR:H = group administrator). This is a genuine priority in environments where Serv-U delegates administration to multiple partially-trusted operators or tenants, because a limited admin can escalate to root RCE. However, the PR:H requirement meaningfully narrows the realistic attacker population versus an unauthenticated flaw, and the vendor notes impact is lower on Windows - so blanket 'critical everywhere' treatment overstates it for single-admin or Windows-only deployments. EPSS is not provided in the input and the CVE is not in CISA KEV, and no POC is referenced, so exploitation probability signals are absent - this is a high-severity-by-impact issue whose real-world likelihood hinges on whether untrusted parties hold group-admin accounts. No SSVC decision data was supplied; automatability is unknown. |
| Exploit ScenarioDerived | A partially-trusted group administrator in a multi-tenant Serv-U deployment authenticates to the admin interface and manipulates a user-controlled object identifier to reference configuration or objects outside their delegated scope. By abusing the IDOR they escalate privileges and execute code as root on the Linux/Unix host, taking over the entire file-transfer server and all tenants' data. No public exploit is identified at time of analysis, and the low attack complexity means the action is straightforward once valid group-admin credentials are held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object reference (IDOR) that lets an authenticated group administrator manipulate object references beyond their authority. The flaw carries a CVSS 9.1 rating because a scope change allows a lower-tier admin to fully compromise the underlying host on Linux/Unix, though impact is reduced on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high privilege prerequisite (group admin) is realistic in multi-tenant MFT environments.
RemediationAI
Patch available per vendor advisory: upgrade Serv-U to the fixed release documented in the Serv-U 2026-3 release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm) and follow the CVE advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28302; the exact patched build number should be confirmed against those pages before deployment. Because exploitation requires group administrator access, the highest-value compensating control until patching is to reduce and tightly vet who holds group-admin roles - remove or downgrade delegated administrators who do not need it, and treat group-admin as a trusted-insider boundary (side effect: reduced delegation flexibility for multi-tenant operations). Additionally, restrict network exposure of the Serv-U management interface to trusted admin networks or a VPN to limit who can reach the authenticated admin surface (trade-off: remote admins must connect via the restricted path), and monitor admin activity/logs for anomalous object references or configuration changes. Prioritizing Linux/Unix hosts first is reasonable since Windows impact is lower.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Serv-U is SolarWinds' managed file transfer (MFT) and secure file server platform (CPE cpe:2.3:a:solarwinds:serv-u), commonly exposing FTP/FTPS/SFTP/HTTP(S) services and a delegated administration model with 'group administrators' who manage a subset of the server. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the application authorizes an action based on a client-supplied object identifier without verifying the requesting group administrator actually owns or is entitled to that object. By substituting or forging these references, the actor reaches privileged objects/configuration that translate into code execution in the security context of the Serv-U service - root on Linux/Unix, and a more constrained context on Windows where the daemon typically does not run with equivalent system-wide authority.
Know when Serv U gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires an authenticated group admin (PR:H) reachable over the network (AV:N) with no interaction; IDOR crosses authority to root RCE, justifying S:C and C/I/A:H.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.
Executive ViewAI
SolarWinds Serv-U contains a critical privilege escalation vulnerability (CVE-2026-28302, CVSS 9.1) that enables authenticated administrators to bypass authorization controls and achieve root-level remote code execution on Linux/Unix systems. Organizations operating multi-tenant managed file transfer platforms face immediate risk of complete infrastructure compromise, as the attack exploits existing admin accounts-a realistic threat in environments where administrative access is distributed across multiple users.
No vendor-released patch identified at time of analysis. Interim mitigations include: network segmentation restricting admin interface access to trusted IPs and VPNs; enhanced logging and real-time alerting on all administrative sessions; enforced reauthentication for sensitive operations; temporary air-gapping of Serv-U from production systems; immediate credential rotation for all group administrator accounts; and evaluation of vendor-supported alternative MFT solutions pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Exploit-DB